From ef9609ae9df4a1ea19378b7f339293fdbd0c32b2 Mon Sep 17 00:00:00 2001 From: EverestAn Date: Thu, 17 Sep 2026 20:53:20 +1000 Subject: [PATCH] chore(deps): bump vitest to 4.1.11 and repin nanoid to 3.3.19 The audit gate fails on two advisories whose patched versions moved after the previous pin was set: - GHSA-2v37-7h3g-55p8 (nanoid, high): the first patched version was revised upward from 3.3.17 to 3.3.18, so the 3.3.17 override no longer satisfies the gate. Repin to 3.3.19, still inside postcss's `^3.3.16` range. - GHSA-82fw-gwwq-j7x9 (vitest / @vitest/mocker, moderate): published 2026-09-08, first patched 4.1.11. Raise the five devDependency ranges from `^4.1.10` to `^4.1.11`. Both are devDependency-only paths reached through vite/postcss; there is no runtime surface in this repository. No protocol, vector, or conformance behaviour changes. Verified: `pnpm audit --audit-level=moderate` reports no known vulnerabilities; `pnpm test:ts`, `check:vectors`, `check:reproducible` and `check:erc-assets` pass. --- implementations/minimal-ts/package.json | 2 +- packages/awareness-adapter/package.json | 2 +- packages/core/package.json | 2 +- packages/examples/package.json | 2 +- packages/reference-engine/package.json | 2 +- pnpm-lock.yaml | 118 ++++++++++++------------ pnpm-workspace.yaml | 6 +- 7 files changed, 68 insertions(+), 66 deletions(-) diff --git a/implementations/minimal-ts/package.json b/implementations/minimal-ts/package.json index 540b936..a9f6fef 100644 --- a/implementations/minimal-ts/package.json +++ b/implementations/minimal-ts/package.json @@ -19,6 +19,6 @@ "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0", - "vitest": "^4.1.10" + "vitest": "^4.1.11" } } diff --git a/packages/awareness-adapter/package.json b/packages/awareness-adapter/package.json index cddd374..16351dd 100644 --- a/packages/awareness-adapter/package.json +++ b/packages/awareness-adapter/package.json @@ -24,7 +24,7 @@ }, "devDependencies": { "typescript": "^5.6.0", - "vitest": "^4.1.10", + "vitest": "^4.1.11", "@types/node": "^22" } } diff --git a/packages/core/package.json b/packages/core/package.json index b0347c4..d7c613d 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -27,6 +27,6 @@ "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0", - "vitest": "^4.1.10" + "vitest": "^4.1.11" } } diff --git a/packages/examples/package.json b/packages/examples/package.json index 2dce747..3077a58 100644 --- a/packages/examples/package.json +++ b/packages/examples/package.json @@ -18,7 +18,7 @@ }, "devDependencies": { "typescript": "^5.6.0", - "vitest": "^4.1.10", + "vitest": "^4.1.11", "@types/node": "^22" } } diff --git a/packages/reference-engine/package.json b/packages/reference-engine/package.json index 2ae17a4..0aaeb19 100644 --- a/packages/reference-engine/package.json +++ b/packages/reference-engine/package.json @@ -26,6 +26,6 @@ "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0", - "vitest": "^4.1.10" + "vitest": "^4.1.11" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f68cd60..f8745bc 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,7 @@ settings: overrides: postcss: '>=8.5.18' - nanoid: 3.3.17 + nanoid: 3.3.19 importers: @@ -35,8 +35,8 @@ importers: specifier: ^5.6.0 version: 5.9.3 vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) packages/awareness-adapter: dependencies: @@ -54,8 +54,8 @@ importers: specifier: ^5.6.0 version: 5.9.3 vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) packages/core: dependencies: @@ -70,8 +70,8 @@ importers: specifier: ^5.6.0 version: 5.9.3 vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) packages/examples: dependencies: @@ -92,8 +92,8 @@ importers: specifier: ^5.6.0 version: 5.9.3 vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) packages/reference-engine: dependencies: @@ -111,8 +111,8 @@ importers: specifier: ^5.6.0 version: 5.9.3 vitest: - specifier: ^4.1.10 - version: 4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) + specifier: ^4.1.11 + version: 4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)) packages: @@ -265,11 +265,11 @@ packages: '@types/node@22.20.1': resolution: {integrity: sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==} - '@vitest/expect@4.1.10': - resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==} + '@vitest/expect@4.1.11': + resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==} - '@vitest/mocker@4.1.10': - resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} + '@vitest/mocker@4.1.11': + resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==} peerDependencies: msw: ^2.4.9 vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -279,20 +279,20 @@ packages: vite: optional: true - '@vitest/pretty-format@4.1.10': - resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==} + '@vitest/pretty-format@4.1.11': + resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==} - '@vitest/runner@4.1.10': - resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==} + '@vitest/runner@4.1.11': + resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==} - '@vitest/snapshot@4.1.10': - resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==} + '@vitest/snapshot@4.1.11': + resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==} - '@vitest/spy@4.1.10': - resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==} + '@vitest/spy@4.1.11': + resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==} - '@vitest/utils@4.1.10': - resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==} + '@vitest/utils@4.1.11': + resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==} assertion-error@2.0.1: resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==} @@ -410,8 +410,8 @@ packages: magic-string@0.30.21: resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==} - nanoid@3.3.17: - resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} + nanoid@3.3.19: + resolution: {integrity: sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -520,20 +520,20 @@ packages: yaml: optional: true - vitest@4.1.10: - resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==} + vitest@4.1.11: + resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.10 - '@vitest/browser-preview': 4.1.10 - '@vitest/browser-webdriverio': 4.1.10 - '@vitest/coverage-istanbul': 4.1.10 - '@vitest/coverage-v8': 4.1.10 - '@vitest/ui': 4.1.10 + '@vitest/browser-playwright': 4.1.11 + '@vitest/browser-preview': 4.1.11 + '@vitest/browser-webdriverio': 4.1.11 + '@vitest/coverage-istanbul': 4.1.11 + '@vitest/coverage-v8': 4.1.11 + '@vitest/ui': 4.1.11 happy-dom: '*' jsdom: '*' vite: ^6.0.0 || ^7.0.0 || ^8.0.0 @@ -674,44 +674,44 @@ snapshots: dependencies: undici-types: 6.21.0 - '@vitest/expect@4.1.10': + '@vitest/expect@4.1.11': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 chai: 6.2.2 tinyrainbow: 3.1.0 - '@vitest/mocker@4.1.10(vite@8.1.4(@types/node@22.20.1))': + '@vitest/mocker@4.1.11(vite@8.1.4(@types/node@22.20.1))': dependencies: - '@vitest/spy': 4.1.10 + '@vitest/spy': 4.1.11 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: vite: 8.1.4(@types/node@22.20.1) - '@vitest/pretty-format@4.1.10': + '@vitest/pretty-format@4.1.11': dependencies: tinyrainbow: 3.1.0 - '@vitest/runner@4.1.10': + '@vitest/runner@4.1.11': dependencies: - '@vitest/utils': 4.1.10 + '@vitest/utils': 4.1.11 pathe: 2.0.3 - '@vitest/snapshot@4.1.10': + '@vitest/snapshot@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/pretty-format': 4.1.11 + '@vitest/utils': 4.1.11 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.10': {} + '@vitest/spy@4.1.11': {} - '@vitest/utils@4.1.10': + '@vitest/utils@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 + '@vitest/pretty-format': 4.1.11 convert-source-map: 2.0.0 tinyrainbow: 3.1.0 @@ -791,7 +791,7 @@ snapshots: dependencies: '@jridgewell/sourcemap-codec': 1.5.5 - nanoid@3.3.17: {} + nanoid@3.3.19: {} obug@2.1.3: {} @@ -803,7 +803,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.17 + nanoid: 3.3.19 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -865,15 +865,15 @@ snapshots: '@types/node': 22.20.1 fsevents: 2.3.3 - vitest@4.1.10(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)): + vitest@4.1.11(@types/node@22.20.1)(vite@8.1.4(@types/node@22.20.1)): dependencies: - '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@8.1.4(@types/node@22.20.1)) - '@vitest/pretty-format': 4.1.10 - '@vitest/runner': 4.1.10 - '@vitest/snapshot': 4.1.10 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/expect': 4.1.11 + '@vitest/mocker': 4.1.11(vite@8.1.4(@types/node@22.20.1)) + '@vitest/pretty-format': 4.1.11 + '@vitest/runner': 4.1.11 + '@vitest/snapshot': 4.1.11 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 es-module-lexer: 2.3.1 expect-type: 1.4.0 magic-string: 0.30.21 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 7bd4fa1..9d42344 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -8,9 +8,11 @@ allowBuilds: esbuild: true # postcss <=8.5.17: GHSA-r28c-9q8g-f849 (path traversal via sourceMappingURL). -# nanoid <3.3.17: GHSA-2v37-7h3g-55p8 (zero-size custom generator loop). +# nanoid <3.3.18: GHSA-2v37-7h3g-55p8 (zero-size custom generator loop). The +# advisory's first patched version was revised upward from 3.3.17 to 3.3.18, so +# the previous pin no longer satisfies the gate. # Both are reached only through vite/vitest devDependencies — no runtime surface # in this repository — but they fail the audit gate, so pin patched versions. overrides: postcss: ">=8.5.18" - nanoid: "3.3.17" + nanoid: "3.3.19"